chore(deps): bump the go-minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the go-minor-and-patch group with 3 updates in the /frontend directory: github.com/go-chi/chi/v5, github.com/oapi-codegen/oapi-codegen/v2 and github.com/oapi-codegen/runtime.

Updates github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1

Release notes

Sourced from github.com/go-chi/chi/v5's releases.

v5.3.1

What's Changed

• Honor Discard() in httpFancyWriter.ReadFrom by @​DucMinhNe in go-chi/chi#1110
• Tidy build directives by @​JRaspass in go-chi/chi#1113
• feat(middleware): add text/xml and application/xml to default compressible types by @​VojtechVitek in go-chi/chi#1127
• Fix defaultLogEntry.Panic not respecting NoColor setting by @​doganarif in go-chi/chi#1050
• middleware: document printPrettyStack and harden NoColor panic test by @​VojtechVitek in go-chi/chi#1131
• feat(mux): support http QUERY method ietf rfc10008 by @​VojtechVitek in go-chi/chi#1132
• ci: pin GitHub Actions to full commit SHAs by @​XananasX7 in go-chi/chi#1116

New Contributors

• @​DucMinhNe made their first contribution in go-chi/chi#1110
• @​doganarif made their first contribution in go-chi/chi#1050
• @​XananasX7 made their first contribution in go-chi/chi#1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

Commits

• 8b258c7 ci: pin GitHub Actions to full commit SHAs (#1116)
• caf87e6 feat(mux): support http QUERY method ietf rfc10008 (#1132)
• 7fcb8a2 middleware: document printPrettyStack and harden NoColor panic test (#1131)
• 878fe71 Fix defaultLogEntry.Panic not respecting NoColor setting (#1050)
• d7b767b feat(middleware): add text/xml and application/xml to default compressible ty...
• 3b50c7c Tidy build directives (#1113)
• 2b9fca2 Honor Discard() in httpFancyWriter.ReadFrom (#1110)
• See full diff in compare view

Updates github.com/oapi-codegen/oapi-codegen/v2 from 2.7.1 to 2.8.0

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

v2.8.0: OpenAPI 3.1, fewer assumptions, and a giant bug hunt

OpenAPI 3.1, webhooks, callbacks, and a lot of polish

This is a big one. After a long stretch of internal refactoring across the last couple of releases, we've been able to land some features that have been on the wishlist for years, most notably initial OpenAPI 3.1 support. As always, the full, automatically-generated changelog is at the bottom, and the sections below call out the things you'll actually want to read before upgrading.

When this project was originally released, it supported a narrow set of OpenAPI features, and over time, it has grown from generating code for hand crafted, structurally tight specifications, to very complex, and often messy specifications. I don't think we can ever handle every specification, however, over time, we're going to give users control over as many behaviors as possible, so that our assumptions, which can't be right for everyone, are configurable. More changes of this form will continue to come in the upcoming releases.

Before you upgrade

A couple of housekeeping notes up front:

• Go 1.25 is now required. If you're not there yet, you'll need to bump your toolchain before pulling this in. We had to update to 1.25 to pull in a kin-openapi that supports OpenAPI 3.1
• Use generated code with runtime v1.6.0 or newer. Several features in this release (the new Duration type, escaped-path-parameter handling, typed response headers) rely on functionality that landed in the runtime, so make sure you're on github.com/oapi-codegen/runtime v1.6.0+ when you regenerate.

☢️ Breaking changes

We try hard to avoid breaking changes, and when we can't, to make them narrow or configurable.

Trailing-slash routes on the net/http server no longer act as catch-alls (#2460)

This one only affects the standard-library net/http server (the one built on ServeMux). It's a correctness fix, which is why we decided to just do it rather than hide it behind a flag.

Here's the problem: a ServeMux pattern ending in / matches the entire subtree beneath it, but an OpenAPI path ending in / means exactly that path and nothing deeper. So we were both mismatching the spec's semantics and, worse, panicking at registration time when two such patterns overlapped ambiguously. We now anchor any trailing-slash path with {$} so it matches only what the spec says it should.

The result: if your spec has trailing-slash paths, requests to deeper URLs that used to get swallowed by the catch-all will now correctly return 404. (ServeMux still issues its usual 307 redirect from the un-slashed path to the canonical one.) If you were relying on the old subtree behavior, that was never what your spec actually declared.

Security scopes are no longer emitted by default (#2440)

Generated servers used to emit per-scheme context key types (bearerAuthContextKey and friends), scope constants (BearerAuthScopes), and per-operation context stores that flattened your spec's security requirements into the request context. We've stopped emitting these by default.

The reason is that this machinery is fundamentally broken: it can't represent alternative (OR), combined (AND), or anonymous ({}) security requirements, so it quietly encourages people to build authorization logic on top of a representation that doesn't actually capture what the spec says. Authentication and authorization belong in the request validation middleware, which evaluates the real security requirements directly.

If you genuinely need the old emission back, there's an opt-in flag:

compatibility:
  enable-auth-scopes-on-context: true

We'd encourage you to migrate to the validation middleware instead, but the flag is there if you need a bridge.

🎉 Notable changes

OpenAPI 3.1 support (#2336)

Finally, after several years of requests, we've been able to close #373, adding OpenAPI 3.1 support. We've added support for callbacks and webhooks, and we support several OpenAPI 3.1 idioms, such as flexible enums via oneOf, as well as type: [T, "null"]-style nullability. This is initial support, so we'd love to hear about the specs it doesn't yet handle well.

While oapi-codegen would love to see an increase in sponsorship to make the project more sustainable, if we had to choose, we'd prefer to see that money go upstream to kin-openapi, which is the OpenAPI library that powers us and a large part of the Go ecosystem.

We're working to sponsor Pierre, the solo kin-openapi maintainer, with a significant portion of our own funds, and really hope that y'all consider sponsorship to support the important work that he does.

... (truncated)

Commits

• de2d8b2 Add sort-handler-registrations flag to opt out of spec-order registration (#2...
• bd52535 Name shared path parameter helper types once, hashing cross-path collisions (...
• ce2e068 feat(#1726): add literal colon support for gin, echo, fiber (#1879)
• 1457922 Fix ValueByDiscriminator() with external refs (#2474)
• 6d3c864 Fix allOf/nullable detection and recursion (#2473)
• 823a7a7 Fix nested allOf/anyOf merging (#2471)
• 9193526 chore(deps): update actions/setup-go action to v7 (.github/workflows) (#2469)
• a07731d Generate shared path-level parameter helper types once (#2466)
• 6574240 Register handlers in spec order (#2465)
• 18ef715 Stringify non-string text/plain responses in strict servers (#2464)
• Additional commits viewable in compare view

Updates github.com/oapi-codegen/runtime from 1.4.2 to 1.6.0

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

Allow customization of parameter encoding

This is a small release which adds a global encoding setting on the runtime, to allow users to customize how to handle spaces in query arguments. This is a new minor release, since we're adding new API, even though this is a very minor feature. I imagine that in the future, we will add more settings, rather than making behavior assumptions.

🚀 New features and improvements

• Allow customizing default query encoder (#145) @​mromaszewicz

📦 Dependency updates

• chore(deps): update module github.com/golangci/golangci-lint to v2.12.2 (#112) @renovate[bot]

Sponsors

We would like to thank our sponsors for their support during this release.

Sponsors

We would like to thank our sponsors for their support during this release.

v1.5.0: RFC3339 durations, and bug fixes

This is mainly a bugfix release, but we're bumping the minor version since we also introduce a new type, Duration into our types/ package, which allows for parsing and emitting RFC3339 durations. Rather than trying to parse a duration string into a time.Duration, which requires assumptions that may not be right for everyone, we decided not to make those decisions and just store all possible fields as provided. Users can convert this to Go Duration as they see fit.

🚀 New features and improvements

• Add types.Duration for the RFC 3339 duration format (#144) @​mromaszewicz

🐛 Bug fixes

• Let generated code declare whether styled parameter values are escaped (#143) @​mromaszewicz
• Prefer the form struct tag over json for form encoding (#140) @​mromaszewicz
• Support binding deepObject parameters into map[string]interface{} (#139) @​mromaszewicz

📝 Documentation updates

... (truncated)

Commits

• 01be2fa chore(deps): update module github.com/golangci/golangci-lint to v2.12.2 (#112)
• 1463938 Allow customizing default query encoder (#145)
• 540d34a fix(deps): update module github.com/labstack/echo/v5 to v5.3.0 (#142)
• e89dbb8 Add types.Duration for the RFC 3339 duration format (#144)
• 324e57f Let generated code declare whether styled parameter values are escaped (#143)
• 95c13c0 Explain how to send nested objects when style serialization fails (#141)
• 7c889f3 Prefer the form struct tag over json for form encoding (#140)
• d0d5c3a chore(deps): update golang/govulncheck-action action to v1.1.0 (#137)
• 67e86fd chore(deps): update oapi-codegen/actions action to v0.8.0 (#130)
• df140cb fix(deps): update module github.com/labstack/echo/v5 to v5.2.1 (#126)
• Additional commits viewable in compare view

Updates golang.org/x/sync from 0.21.0 to 0.22.0

Commits

• 1eb64d4 semaphore: panic on negative weights
• See full diff in compare view